Migrating users from 4.0 to 5.0

[jacobs_acando]

We're still using a Splunk 4.0 instance and want to upgrade to Splunk 5 (or even 6).
Now the question is how users can be migrated between those two versions?

I've tried the

splunk export userdata
splunk import userdata

commands.

The users are created in passwd but a login isn't possible ("wrong password") in the new Splunk. I've read that they way how Splunk hashes/salts passwords has been changed between Splunk 4.0 and 5 and it seems that this not taken into account when importing users from an old instance? Also the user folders with their custom configurations are not migrated.

Well, as I'm writing this down and thinking about it I notice that if it's actually true that the hashing algorithm has changed of course Splunk cannot migrate the passwords. Does this really mean all users have to be manually recreated?

[MuS · Accepted solution]

Hi jacobs_acando,

direct upgrade from 4.1 (or earlier versions) to 5.x or even 6.x is not supported.
You should upgrade to 4.2 first, see the docs about it, and upgrade to the next version you finally want. Just remember to check each doc on how to upgrade from previous versions.

hope this helps ...

cheers, MuS

[MuS]

Save a backup of your 4.x install and test the upgrade path. If you follow the instruction, there should be no problem with your users.

[jacobs_acando]

So the upgrade path 4.0 -> 4.2 -> 5.0/6.0 will retain the users and user data?